Keeping OAB/Payroll data protected in Dev/Test instances

We recently implemeted Payroll and OAB and are wondering how you all deal with that confidential data in all of our dev/test instances.  We used to scrub the confidential data in the dev/test instances, but that was before payroll and OAB.  There were not many fields we needed to deal with (example: grade, annual salary, birthdate, ssn ect.) 

Now with OAB and Payroll going live including self service payslips, I really don't know where to start for scrubbing all this different data or do we just not give application administrator to analyst/developers in the dev/test instances.  Any suggestions would be greatly appreciated.